Executive brief
Fomantic UI is a widely-used frontend CSS framework that provides pre-built user interface components, including dropdown menus. A cross-site scripting (XSS) vulnerability in the dropdown selection feature allows attackers to inject and execute malicious scripts by manipulating dropdown options, potentially compromising user sessions, stealing data, or defacing the application interface. Organizations using affected versions risk exposing their web applications and users to script injection attacks.
Technical details
The vulnerability is a classic cross-site scripting (CWE-79) flaw arising from lack of output encoding on selection dropdown options. When user input or untrusted data is rendered into dropdown selection fields, the library fails to properly escape or sanitize the content, allowing malicious JavaScript to be injected and executed in the user's browser. The attack vector is network-based and typically requires user interaction (e.g., viewing a page with a vulnerable dropdown populated by attacker-controlled data). An attacker can achieve arbitrary JavaScript execution in the victim's browser context, leading to session hijacking, credential theft, or malware distribution. The fix was released in version 2.7.0 (December 21, 2018); all earlier versions are affected and should be upgraded.
Affected products
- Fomantic Fomantic UI prior to 2.7.0
Timeline
- 2020-09-02: disclosed: Advisory published to GitHub Security Advisory database
- 2018-12-21: patched: Version 2.7.0 released with fix